0ba781617886b0fa972618bf0fae334e27efea2199ad5b1eeae7738a756c3ff6

Analysis

max time kernel
139s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2023, 04:09

Target
file.exe
Size 393KB
Sample230919-eqstsaeg41
SHA256 0ba781617886b0fa972618bf0fae334e27efea2199ad5b1eeae7738a756c3ff6
MD5 dd9e11581ab37ef7c17211549b001728
SHA1 5f56447495fa9f8bde569491ca53d6975f47172d
SHA512 e2cc4963dfb80dc33b61b374b0ef9a5b97d0baf937e41a9f14294611de4d88351e3a689403b09c0c5c6180af5bd4ea5e14da68a3178a338072ab6b1d6f22115c
SSDEEP 12288:FiQDqiG59oupkdxT6NJlqiNR5EwdlzDBMsseEgo+0LBSOb0chy23Dx1Sa:FiQw565urhPZcdxs
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2688 set thread context of 1624	2688	file.exe	88

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 1624	2688	file.exe	88
PID 2688 wrote to memory of 1624	2688	file.exe	88
PID 2688 wrote to memory of 1624	2688	file.exe	88
PID 2688 wrote to memory of 1624	2688	file.exe	88
PID 2688 wrote to memory of 1624	2688	file.exe	88
PID 2688 wrote to memory of 1624	2688	file.exe	88
PID 2688 wrote to memory of 1624	2688	file.exe	88
PID 2688 wrote to memory of 1624	2688	file.exe	88
PID 2688 wrote to memory of 1624	2688	file.exe	88
PID 2688 wrote to memory of 1624	2688	file.exe	88

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1624

memory/1624-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1624-1-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1624-2-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1624-3-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1624-4-0x0000000000400000-0x000000000042F000-memory.dmp

Download